Organic Groups: anonymous users have full access to view group content

Hello,

Not sure if this will help, but when I first started using Taxonomy Access to limit the content to certain users I found that the anonymous user could see everything. If you look at the node_access table, then the very first entry is probably:

nid=0, gid=0, realm=all, grant_view=1, grant_update=0, grant_delete=0.

What this effectively does is allows anonymous users to see any content.
If you change grant_view=0, then you are telling the system that anonymous user cannot see any content unless explicitly allowed.

In my system I configure Taxonomy Access to allow anonymous user to see certain content but not other content.

Thanks.

In og.module, function og_save_permissions(), ~ line 1526, there's the comment

// all groups are publically accessible, although their posts may not be
// if you really want an inaccessible group homepage, you should go to node_access table and delete the record which is inserted here.

So in node_access table, for og group with node=2, I deleted the row "2 0 og_all 1 0 0".

This makes the group non-public to non-subscribers.

Also, to ensure all future groups I create are also non-public, I edited the line ~1529 in the same function to be:

$sql = "INSERT INTO {node_access} (nid, gid, realm, grant_view) VALUES (%d, 0, 'og_all', 0)";

instead of 'og_all',1.